CODEWITHSUNDEEP
javaregexxmllog4j
Brett Jeffreson
Brett Jeffreson

Reputation: 563

Log4j 1.2.15 ExpressionFilter regex

I'll preface this by saying I have to use Log4j 1.2.15 unfortunately, please don't suggest I upgrade. I do, however, have access to the Extras companion version 1.1.

I am trying to use an ExpressionFilter to match any message that contains at least one '-' symbol followed by any number of digits 0-9. For example: -03928474 or --27646 etc.

EDIT: Example of full string: <ClassName---0182364759> xxx this is a debug message

I want to match part of this.

I am using the following expression: MSG LIKE [-]{1,}[0-9]{1,}

This should serve my needs based on every regex building site I have tried. Note that I tried \d{1,} instead of [0-9]{1,} but Log4j would remove the \d from the expression (I have debug turned on).

The other ExpressionFilters in the Appender work as expected so I do not think this is a problem with the structure of the Appender.

This is the one that doesn't work:

<filter class="org.apache.log4j.filter.ExpressionFilter">
    <param name="Expression" value="(MSG LIKE [-]{1,}[0-9]{1,})" />
    <param name="AcceptOnMatch" value="true" />
</filter>

in the same appender on the next line, DOES work:

<filter class="org.apache.log4j.filter.ExpressionFilter">
    <param name="Expression" value="(LEVEL >= WARN)" />
    <param name="AcceptOnMatch" value="true" />
</filter>

This must be specified in xml.

I know it's a long shot, but is anyone familiar with the peculiarities of the way Log4j 1.2 handles regex or is able to point out where I have gone wrong?

Upvotes: 1

Views: 2943

Answers (1)

Brett Jeffreson
Brett Jeffreson

Reputation: 563

Alright, so it turns out that the LIKE rule in Log4j 1.2 uses matcher.matches() which matches the entire string, whereas I wanted to only partially match the string.

The solution was as follows:

.*-+[0-9]+.*

This matches any number of non-newline characters before and after the partial match I want.

Upvotes: 1

Related Questions